Android操作系统级虚拟化下的应用自动登录功能安全测试
App's Auto-Login Function Security Testing via Android OS-Level Virtualization
摘要：
受小键盘的限制，大多数移动应用都支持自动登录功能，以获得更好的用户体验。因此，当应用再次在前台运行时，用户避免了重新输入ID和密码的不便。然而，这种自动登录功能可以被利用来发动所谓的“数据克隆攻击”：一旦本地存储的、依赖于自动登录的数据被攻击者克隆并放置到自己的智能手机中，攻击者就可以突破登录设备数量限制，悄悄登录受害者的帐户。一个自然的对策是检查特定于设备的属性的一致性。只要新设备显示与前一个不同的设备指纹，应用程序将禁用自动登录功能，从而防止数据克隆攻击。在本文中，我们开发了VPDroid，一个透明的Android操作系统级的虚拟化平台，专为安全测试。使用VPDroid，安全分析师可以在虚拟电话中自定义不同的设备工件，例如CPU型号，Android ID和电话号码，而无需用户级API挂钩。VPDroid的隔离机制确保虚拟手机中的用户模式应用程序无法检测到特定于设备的差异。为了评估Android应用程序对数据克隆攻击的敏感性，我们使用VPDroid模拟了234个下载量最大的应用程序的数据克隆攻击。我们在五个不同的虚拟手机环境中进行的实验表明，VPDroid的设备属性自定义可以欺骗所有执行设备一致性检查的测试应用程序，例如Twitter，WeChat和PayPal。19家供应商已确认我们的报告为零日漏洞。我们的研究结果描绘了一个警示故事：只有在客户端执行设备一致性检查仍然容易受到高级数据克隆攻击。
英文摘要：
Limited by the small keyboard, most mobile apps support the automatic login feature for better user experience. Therefore, users avoid the inconvenience of retyping their ID and password when an app runs in the foreground again. However, this auto-login function can be exploited to launch the so-called "data-clone attack": once the locally-stored, auto-login depended data are cloned by attackers and placed into their own smartphones, attackers can break through the login-device number limit and log in to the victim's account stealthily. A natural countermeasure is to check the consistency of devicespecific attributes. As long as the new device shows different device fingerprints with the previous one, the app will disable the auto-login function and thus prevent data-clone attacks. In this paper, we develop VPDroid, a transparent Android OS-level virtualization platform tailored for security testing. With VPDroid, security analysts can customize different device artifacts, such as CPU model, Android ID, and phone number, in a virtual phone without user-level API hooking. VPDroid's isolation mechanism ensures that user-mode apps in the virtual phone cannot detect device-specific discrepancies. To assess Android apps' susceptibility to the data-clone attack, we use VPDroid to simulate data-clone attacks with 234 most-downloaded apps. Our experiments on five different virtual phone environments show that VPDroid's device attribute customization can deceive all tested apps that perform device-consistency checks, such as Twitter, WeChat, and PayPal. 19 vendors have confirmed our report as a zero-day vulnerability. Our findings paint a cautionary tale: only enforcing a device-consistency check at client side is still vulnerable to an advanced data-clone attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
